Efficient quantum cryptography network without entanglement and quantum memory* 
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An efficient quantum cryptography network protocol is proposed with d-dimension polarized pho- 
tons, without resorting to entanglement and quantum memory. A server on the network, say Alice, 
provides the service for preparing and measuring single photons whose initial state are |0). The users 
code the information on the single photons with some unitary operations. For preventing the un- 
trustworthy server Alice from eavesdropping the quantum lines, a nonorthogonal-coding technique 
(decoy-photon technique) is used in the process that the quantum signal is transmitted between 
the users. This protocol does not require the servers and the users to store the quantum state and 
almost all of the single photons can be used for carrying the information, which makes it more 
convenient for application than others with present technology. We also discuss the case with a 
faint laser pulse. 

PACS numbers: 03.67.Dd, 03.67.Hk 



Preventing a vicious eavesdropper, say Eve from steal- 
ing the message in communication is one of the most 
important issues nowadays. In the classical communica- 
tion, the security of the public key crypto-systems is gen- 
erally based on their computational complexity. For ex- 
ample, the security of the Rivest-Shaniir-Adleman public 
key scheme [l| depends on the difficulty of factoring a 
large integer. Up to now, none of them has been proven 
to be unconditionally secure. The Vernam one-time pad 
crypto-system provides a secure way for two remote 
parties to communicate with a private key which is re- 
quired to be long as the message and can only be used 
one time securely. As a classical signal is in one of the 
eigenvectors of a operator, it can be copied fully and 
freely. Quantum cryptography or quantum key distribu- 
tion (QKD) [3, 01 provides a secure way for creating a 
private key between two authorized users, and becomes 
one of the most important applications of quantum in- 
formation For instance, Bennett and Brassard 
presented an original QKD protocol, called BB84, 
with four nonorthogonal single-photon states in 1984 , 
and Ekert introduced a QKD protocol based on the 
correlation of a maximally entangled two-particle quan- 
tum system, an Einstein-Podolsky-Rosen(EPR) pair in 
1991. Now, there is much attention focused on QKD 
0, i, i, 0, S, i, 0, [H Hi- It has been also well devel- 
oped in experimental implementations [3] ■ 

In recent years, the any-to-any QKD protocols for 
the secure communication on a passive optical network, 
which is a requirement of practical implementations, have 
been studied by some groups [H El, [H [H [13, E, [H ■ 
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Phoenix et al. [13] proposed a multi-user QKD scheme 
with single photons in 1995 following the ideas in Ben- 
nett 1992 protocol [| and BB84 QKD protocol \^\. In 
this scheme, half of the quantum information carriers 
(QIC) are useful for carrying the information if they re- 
move the ideas from BB84 QKD. Its efficiency for qubits 
rig = ^ = 50%, the same as that in BB84 QKD. 
Here is useful qubits and qt is total qubits used. In 
1997 Townsend [14] demonstrated the multi-user QKD 
(MUQKD) on an optical fiber networks with faint laser 
pulses following the ideas in BB84 QKD [s*]. Biham et al. 
[15| proposed a MUQKD protocol with quantum mem- 
ories in 1996. In their MUQKD scheme, no more than 
I QIC can be used as the qubits for the raw key. The 
advantage is that the users on the network can work with- 
out quantum channels if they store the QIC in the quan- 
tum memories in advance [isj . Xue et al [lB| presented a 
way for MUQKD using the mixture of single photons and 
EPR pairs as the QIC. The efficiency rjq was improved to 
approach 100% with the ideas in Ref. [Q]. Another two 
MUQKD schemes [13, [11] were presented by modifying 
the quantum dense coding [59] and the point-to-point 
QKD protocol proposed by Long and Liu [13]. In these 
two MUQKD schemes, the QIC are EPR pairs. More- 
over, their efficiency rjq is improved to approach 100% 
only when the users or the servers on the network ex- 
ploit quantum memory to store the QIC. Although the 
technique of quantum storage is a vital ingredient for 
quantum information and there has been a great deal of 
interests in developing it [2lj, it cannot be used in the 
practical application at present. 

In this Letter, we will introduce a new multi-user QKD 
network protocol without resorting to entanglement and 
quantum memory. The d-dimensional single photons are 
prepared and measured by the server Alice on the net- 
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work with one measuring basis (MB). The users code 
the information on the single photons with some unitary 
operations, and each photon can carry log2d bits of infor- 
mation. Almost all the photons can be used to carry the 
useful information, the efhciency for qubts rjq approaches 
100%. The users can exploit some decoy photons (in 
nonorthogonal states) which are obtained by operating 
some samples with a Hadamard operation to ensure the 
security of the quantum communication. We also discuss 
this multi-user network with a faint laser pulse. 
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FIG. 1: The subsystem of the network in this MUQKD 
scheme, similar to those in Refs. [H, Hi, EE, [13, Hlil. 
PNS: photon number splitter; Dm {m = 1,2,3,4) are four 
single-photon detectors. Ub and Uc are the operations done 
by Bob and Charlie, respectively. 



We use the same structure of the network as those in 
Refs. [H B El d, [O, Hi in the present MUQKD 
network protocol, i.e., its subsystem (a cell of the QKD 
network) can be simplified to three parts, the server (Al- 
ice), the sender (Bob) and the receiver (Charlie). All the 
cells build up a practical network. A MUQKD scheme 
is explicit if the principle of its subsystem is described 
clearly [H, M MMMMM- 

A subsystem in our MUQKD scheme is shown in Fig.l. 
Alice provides the service for preparing and measuring 
the polarized d-dimensional single photon T. For a d- 
dimensional single photon, we can choose two nonorthog- 
onal MBs as Zd and Xa [13 • The MB Za which has d 
eigenvectors can be written as: 

|0), |1), |2), |d-l). (1) 

The d eigenvectors of the MB Xd can be described as 
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The two vectors |fc) and 1^)2; coming from two MBs sat- 
isfy the relation |(A;|^)a:p = ^. We can use the unitary 
operation Uj (j = 0, 1, • • • , d — 1) to transfer the state |0) 
into another state i.e., Uj\Q) — \ 



U, = \j){0\. 
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Moreover, the d-dimensional Hadamard [Hd) operation 
can transfer an eigenvector of the MB Zd into that of the 
MB Xd, i.e., Hd\j) = Here [H 
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For simplifying the process of error rate analysis, the 
traveling single photon T is prepared by the server Al- 
ice initially in the state |0)^ = |0) in each round. That 
is, all the users including the server Alice agree that the 
original state of the traveling single photon T is |0). Al- 
ice sends the photon T to the sender Bob. Bob chooses 
two modes, the checking-eavesdropping mode and the 
message-coding mode, for the photon received with the 
probabilities 1 — and Pbm, respectively, similar to 
Refs. 23]. When he chooses the checking-eavesdropping 
mode. Bob measures the photon with the MB Zd- When 
he chooses the message-coding mode. Bob codes the pho- 
ton T by choosing randomly one of the d unitary oper- 
ations {Uj}, say Ub- Moreover, Bob should exploit a 
nonorthogonal-coding technique (i.e., decoy-photon tech- 
nique) to determine whether an eavesdropper is monitor- 
ing the quantum line between the two users. That is. 
Bob should replace the photon T with a decoy one in 
a nonorthogonal state by using a probability Pd (< \) 
before he sends it to the receiver Charlie. In detail, he 
can prepare the decoy photon by performing a Hd opera- 
tion on the traveling photon T after coding it with one of 
the unitary operations {Uj} randomly (The decoy pho- 
ton in this scheme is different from the decoy state in Ref. 
[24| . It is just a photon in a nonorthogonal state, com- 
pared with its original state, not the faint pulses with 
different intensities.). In this way, the decoy photon is 
randomly in one of the d states {lO)^;, \l)x, ■ ■ ■ ,\d — l)^}- 
After receiving the photon T, Charlie operates it sim- 
ilar to Bob. That is, Charlie performs the operation 
Uc G {Umn = \m){n\; m,n = 0, 1, • • • , d — 1} on the 
photon and then sends it to the server Alice if Charlie 
chooses the message-coding mode, otherwise he measures 
the photon with one of the two MBs Zd and Xd by using 
the probabilities Pcz and Pcx, respectively. If Alice re- 
ceived the photon T, she measures it with the MB Zd and 
publishes the difference between its original state and the 
final one. After Bob deletes the results coming from the 
decoy photons measured by Alice, Charlie can obtain the 
outcomes Ua = Ub ®Uc- 
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For preventing the eavesdropper from stealing the in- 
formation about the operations U b done by Bob with a 
multi-photon signal [25|, Bob should check the number 
of the photons in each signal. That is, Bob should anal- 
yse the probability that the case in which there arc more 
than one photon in the signal takes place. This task can 
be completed by sampling a subset of signals randomly 
and measuring them with two single-photon detectors af- 
ter splitting them with a photon number splitter (PNS), 
see Fig.l. In fact, the check done by Bob is just used 
to determine whether the untrustworthy server Alice in- 
serts a Trojan horse in the original signal. Certainly, Bob 
should use a special filter (just the photons with the spe- 
cial frequency can penetrate it 111) to filtrate the light 
from background or a fake signal [26] before he operates 
the photons. The receiver Charlie should also do the op- 
eration same as Bob to prevent Alice from eavesdropping 
with a Trojan horse attack. 

With the decoy photons and PNSs, Bob and Charlie 
can check the security of their quantum communication 
by analyzing a large enough subset of the results. As the 
initial state of the photons is |0), the analysis of the error 
rate done by Bob an Charlie does not need the help of the 
server Alice. Bob and Charlie can check eavesdropping 
efficiently with a refined error analysis technique same 
as that in Ref. Thus this MUQKD protocol can be 
made to be secure. 

Now let us discuss several issues. Firstly, the require- 
ment that the travelling photon T is initially in the state 
|0) is useful for improving the security of this MUQKD 
protocol against dishonest servers. If the photon T is ran- 
domly in one of the states the error rate analysis 
of the samples transmitted from Bob to Charlie needs 
the help of the server Alice. In this way, Alice can 
eavesdrop the operations done by Bob and Charlie fully 
and freely, and hide her attack with a cheat. We use 
the case with a two-dimensional polarized single pho- 
ton to describe the principle of this attack. In detail, 
we assume that the state of the photon T is \'ip')T G 
{|0), |1|, I + x) = ^(|0) + |1)), I - .t) = ^(|0) - |1))}. 
Alice intercepts the photon T after it is operated by 
the sender Bob, and stores it. She sends one photon 
in an EPR pair in the state \iI)~)ab = '^{\^^) ~ |10))ab 
to Charlie, say the photon i?, instead of the original 
one T. If Charlie chooses the message-coding mode on 
the photon B, Alice measures the photon T with the 
MB Z and performs a Bell-basis measurement on the 
EPR pair. Obviously, she can obtain all the information 
about the operations Ub and Uc because Charlie only 
chooses one of the two operations Uq = |0)(0| -I- |1)(1| 
and Ui = |0)(1| -I- |1)(0| which make the EPR pair in 
the states \'>P')ab and = ^(|00) - \11))ab, re- 
spectively. If Charlie chooses the checking-eavesdropping 
mode, Alice performs a Bell-basis measurement on the 
photons A and T. It is well known that the state of 
the photon B measured by Charlie is correlated to the 
results of the Bell-basis measurements [l^- That is, if 
the results are \iI>-)at, |V'"^)^t, \(t>~) at and |0+)at, Al- 



ice needs only publish a fake information about the initial 
state of the photon T after the unitary operations I ~ Uq, 
<^z = |0)(0| -Jl)(l|, = Ui and lay = |0)(1| - |1)(0|, 
respectively [l^. Here \4^+)at - ^(|01) + |10))at 
and \(j)'^)AT = "^(|00) + |11))at- Fortunately, in our 
MUQKD protocol, the users can accomplish the error 
rate analysis without the help of the server, which makes 
the attack invalid. 

Secondly, different from Ref. @, Charlie can choose 
the MB Xd with a large probability when he chooses the 
checking-eavesdropping mode for obtaining more corre- 
lated outcomes. For the symmetry, we assume that the 
outcome useful obtained with the MB is equal to that 
with the MB Xd, i.e.. 
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where Pbm and Pcm are the probabilities that Bob and 
Charlie choose the message-coding mode, respectively; 
Pcz and Pcx = 1 — Pcz are the probabilities that Charlie 
measures his samples with the MB Zd and Xd, respec- 
tively. That is, when Pcz = Pd, the probability that Bob 
and Charlie obtain the correlated outcomes of the sam- 
ples approaches the maximal value Peu = 2(1 — Pd)Pd- 

Thirdly, let us discuss the case that our MUQKD pro- 
tocol is implemented with a practical faint laser pulse. 
The probability that there are n photons in a pulse fol- 
lows the Poisson statistics Ijl, 



P{n,fi) = —re 



(6) 



where n is the number of photons in a coherent state and 
fi = (n) is the mean photon number. Then the probabili- 
ties that a non-empty weak coherent pulse contains more 
than one photon is ^ 



P{n > l\n > 0,Ai) = 



i-p(o,m)~p(i,a^) 

1-P(0,m) 
1 - (1 + ^i)e-^' ^ ^ 
1 - e-^ ~ 2' 
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If ^ = 0.05, the probabilities P{n > l\n > 0, fi = 0.05) « 
2.5%. That is, when the Fock states are attenuated to 
one photon per 20 pulses, the probability that there are 
more than one photon in a pulse is about 2.5%. 

The instances with more than one photons in a pulse 
will decrease the security of this MUQKD protocol. The 
reason is that the dishonest server can split one photon 
from the multi-photon pulse operated by Bob and mea- 
sure it with the MB Zd- In this way, Alice can get all 
the useful information about the operation Ub- With 
the outcome Ua, she can obtain the private key fully and 
freely. In order to prevent Alice from stealing the infor- 
mation with PNS attack, the probability Pcu that the 
receiver Charlie obtains an useful outcome when he mea- 
sures a sample photon run from Bob is by far larger than 
the probability P{n > l\n > 0, jj, — 0.05), i.e., 

Pen = VoptVd > P(n > l|n > 0, = 0.05) = 2.5%, (8) 
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where riopt and rjd are the efficiency of the transmission on 
a fibre and that of a detector, respectively. Otherwise, 
Ahce can steal some of the information about the key 
with a better quantum channel. In detail, Alice, on one 
hand, intercepts all the single-photon pulse and discards 
them. On other hand, she splits the multi-photon sig- 
nal with some PNSs and sends one of the photons in the 
pulse to Charlie with a nearly ideal channel in which the 
loss is very low. Obviously, her eavesdropping does not 
introduce errors in the outcomes of the samples chosen by 
Charlie. Moreover, the loss of the signal is compensated 
with a good channel. Thus Bob and Charlie cannot de- 
tect Alice's vicious action. But the story is changed when 
Pcu > P{n > l|n > 0,/i = 0.05). In this time. Bob and 
Charlie can monitor the number of the photons in each 
signal by sampling some pulses randomly and measur- 
ing them after splitting with some PNSs. On the other 
hand. Bob and Charlie can exploit privacy amplification 
to distil a short key privately [j]. 

Compared with the MUQKD protocols existing [l^, 
[H, [3 [i3j m, 13 J this one requires the users on the 
network to have the capability of measuring single pho- 
tons and unitary operations, not Bell-basis measurement 
and quantum memory, which makes it more convenient 
in application. Moreover, the efficiency for qubits rjq ap- 
proaches 100% as almost all the photons can be used to 
generating the private key but those for checking eaves- 



dropping (its number is negligible). The total efficiency 
T]t = -^f^ also approaches the maximal value 50% as Al- 
ice need only publish one bit of classical information for 
each useful qubit, i.e., qu — qt = bt = 1. Although the 
technique for splitting some photons is in developing [J] , 
the users can use photon beam splitter (PBS) to replace 
PNS for determining the probability that there are more 
than one photon in each signal. 

In summary, we have presented a MUQKD network 
protocol without entanglement and quantum memory. 
The users on the network exploit some unitary opera- 
tions to code their information on a travelling photon. 
As the initial state of the photon prepared by the server 
is |0), the sender can perform a Hadamard operation on 
the photon operated to produce a decoy one which is used 
to forbid the dishonest server to eavesdrop freely. With 
some PNSs, this MUQKD network protocol can be made 
to be secure. The efficiency for qubits and the total effi- 
ciency both approach the maximal values, and then this 
protocol is an optimal one. Moreover, we discuss the case 
with a faint laser pules. 
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